System and method for adaptive graphical depiction and selective remediation of cybersecurity threats

Abstract

A method for performing cyber-security analysis includes generating a semantic graph in which each object is represented as a node, and each event associated with an object is represented as an edge. A cyber-threat related alert, with an associated alert type, is received from a source. A first object from the plurality of objects is modified based on the alert. A plurality of threat scores, each associated with an object, are calculated, substantially concurrently, based on the alert type. Subsequently, a plurality of modified threat scores are determined for each object, based on: (1) the threat score for that object, (2) a connectivity of that object to each of the remaining objects within the semantic graph; and (3) the threat score for each remaining object from the plurality of objects. A subgraph of the semantic graph is identified based on normalized versions of the modified threat scores.

The invention claimed is: 
     
       1. A cyber-security analysis method, comprising:
 generating, via a compute device, a semantic graph that represents a plurality of objects and a plurality of events associated with the plurality of objects, each object from the plurality of objects represented as a node in the semantic graph, and each event from the plurality of events represented as an edge in the semantic graph; 
 receiving, at the compute device and from a source, a signal representing an alert, the alert having an associated alert type and related to a cyber-threat; 
 modifying a first object from the plurality of objects, based on the alert, to produce a modified first object, the plurality of objects including the modified first object; 
 calculating, at a first time, a plurality of threat scores, each threat score from the plurality of threat scores (1) based on the alert type, and (2) associated with an object from the plurality of objects; 
 determining, at a second time after the first time, and via the compute device, a plurality of modified threat scores for each object from the plurality of objects, each modified threat score from the plurality of modified threat scores based on: (1) the threat score for that object, (2) a connectivity of that object to each remaining object within the semantic graph; and (3) the threat score for each remaining object from the plurality of objects; 
 normalizing the plurality of modified threat scores, to generate a plurality of normalized threat scores; 
 identifying a subgraph of the semantic graph based on the plurality of normalized threat scores; and 
 sending a signal to cause display of: (1) the subgraph within a graphical user interface (GUI) in a manner to distinguish the subgraph from a remaining portion of the semantic graph, and (2) a user-selectable feature to authorize remediation of the cyber-threat. 
 
     
     
       2. The method of  claim 1 , wherein the determining the plurality of modified threat scores is performed using an algorithm including at least one of: PageRank, Hyperlink-Induced Topic Search (HITS), diffusion wavelet analysis, or a sum-product message passing algorithm. 
     
     
       3. The method of  claim 1 , further comprising modifying each object from the at least a subset of the remaining objects, such that that object includes an attribute associated with the alert. 
     
     
       4. The method of  claim 1 , wherein the calculating the plurality of threat scores is performed according to the following equation: 
       
         
           
             
               
                 M 
                 x 
               
               = 
               
                 
                   ∑ 
                   
                     i 
                     ∈ 
                     alerts 
                   
                 
                 ⁢ 
                 
                   
                     w 
                     i 
                   
                   ⁢ 
                   
                     n 
                     i 
                   
                 
               
             
           
         
       
       where M x  is the threat score for a node x, w i  is a weight of alert type i, and n i  is a number of times the alert type has occurred with respect to the modified first object and within a current analysis period. 
     
     
       5. The method of  claim 4 , wherein the weight for the alert type is based on at least one of a quality of the alert type or the source. 
     
     
       6. The method of  claim 1 , wherein each edge in the semantic graph represents a frequency of occurrence, the method further comprising updating, in response to receiving event data, the frequency of occurrence of each edge in the semantic graph. 
     
     
       7. The method of  claim 1 , wherein each modified threat score from the plurality of modified threat scores, for each object from the plurality of objects, is calculated according to the following equation: 
       
         
           
             
               
                 Relevance 
                 - 
                 BR 
               
               BR 
             
           
         
       
       where BR is a baseline rank for that object and Relevance is a current relevance for that object. 
     
     
       8. The method of  claim 1 , further comprising continuously updating the semantic graph in response to detection, over time, of at least one of: a plurality of new objects, a plurality of new events, or a plurality of new alerts. 
     
     
       9. The method of  claim 1 , wherein the determining the plurality of modified threat scores is performed after at least one of: a specified number of alerts have been received, or a specified interval of time has elapsed. 
     
     
       10. A method implemented by a security operations center, comprising:
 generating, via a compute device, a semantic graph including a plurality of nodes and a plurality of edges, each node from the plurality of nodes representing an object from a plurality of objects, each edge from the plurality of edges representing an event from a plurality of events; 
 sending a signal to cause display, via a GUI, of the semantic graph, each edge from the plurality of edges having an associated tally that actively updates in response to additional instances of the event associated with that edge; 
 logging, at the compute device, event data for the compute device; 
 updating the semantic graph based on the event data, the updating including:
 modifying an alert attribute of a first object from the plurality of objects when the event data includes an alert applicable to the first object, 
 modifying a threat score of each object from the plurality of objects based on the event data, 
 decomposing the event data into a set of objects and a set of events, and 
 updating at least one of (i) a number of occurrences of an edge from the plurality of edges, or (ii) a frequency of occurrence of the edge from the plurality of edges, based on the set of events; 
 
 detecting, subsequent to the display of the semantic graph, a subgraph of the semantic graph based on a plurality of normalized threat scores associated with the plurality of objects; and 
 sending a signal to cause display, via the GUI, of the subgraph, in a manner to distinguish the subgraph from a remaining portion of the semantic graph. 
 
     
     
       11. The method of  claim 10 ,
 wherein the signal to cause display, via the GUI, of the subgraph does not cause display of the remaining portion of the semantic graph. 
 
     
     
       12. The method of  claim 10 , wherein the alert attribute includes a timestamp associated with the alert. 
     
     
       13. The method of  claim 10 , further comprising continuously updating the semantic graph in response to detection, over time, of at least one of: a plurality of new objects, a plurality of new events, or a plurality of new alerts. 
     
     
       14. The method of  claim 10 , wherein the logging of the event data is performed according to a predefined schedule. 
     
     
       15. A non-transitory processor-readable medium storing code representing instructions to cause a processor to:
 generate a semantic graph representing a plurality of nodes and a plurality of edges, each node from the plurality of nodes representing an object from a plurality of objects, each edge from the plurality of edges representing an event from a plurality of events; 
 store alert data for a cyber-alert, the alert data including an alert type, an associated weight, and a number of occurrences; 
 calculate associations between each object from the plurality of objects and at least a portion of the alert data; 
 calculate a plurality of threat scores for the plurality of objects based on the event data and the alert data; 
 propagate the plurality of threat scores to at least a subset of the plurality of objects, based at least in part on the associations; 
 normalize the plurality of threat scores, to generate a plurality of normalized threat scores; 
 identify a high-risk subgraph of the semantic graph based on the plurality of normalized threat scores; and 
 send a signal to cause display of: (1) the subgraph within a graphical user interface (GUI) in a manner to distinguish the subgraph from a remaining portion of the semantic graph, and (2) a user-selectable feature to authorize remediation of the cyber-threat. 
 
     
     
       16. The non-transitory processor-readable medium of  claim 15 , wherein the instructions to cause the processor to calculate associations between each object from the plurality of objects and at least a portion of the alert data include instructions to cause the processor to calculate a relevance of the cyber-alert to each object from the plurality of objects. 
     
     
       17. The non-transitory processor-readable medium of  claim 15 , wherein the cyber-alert is a first cyber-alert, and the code further represents instructions to cause the processor to:
 calculate an updated plurality of threat scores for the plurality of objects based on a second cyber-alert; and 
 propagate the updated plurality of threat scores to at least the subset of the plurality of objects. 
 
     
     
       18. The non-transitory processor-readable medium of  claim 17 , wherein the instructions to cause the processor to calculate the updated plurality of threat scores include instructions to cause the processor to:
 calculate associations between each object from the plurality of objects and data associated with the second cyber-alert; and 
 calculate the updated plurality of threat scores based on the associations between each object from the plurality of objects and data associated with the second cyber-alert. 
 
     
     
       19. The non-transitory processor-readable medium of  claim 15 , wherein the event data is a first event data, and the code further represents instructions to cause the processor to:
 receive, after receiving the first event data, a second event data; 
 increment a number of occurrences associated with at least one event from the plurality of events to produce an incremented number of occurrences; and 
 send a signal, in response to incrementing the stored number of occurrences, to cause display of a modified subgraph including the incremented number of occurrences within the GUI.